<html>
<head><meta charset="utf-8"><title>Is it safe? · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html">Is it safe?</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="186782714"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186782714" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186782714">(Jan 28 2020 at 13:38)</a>:</h4>
<p>got an <code>unsafe</code>-using PR to <code>zeroize</code>: <a href="https://github.com/iqlusioninc/crates/pull/341/files" target="_blank" title="https://github.com/iqlusioninc/crates/pull/341/files">https://github.com/iqlusioninc/crates/pull/341/files</a></p>



<a name="186782734"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186782734" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186782734">(Jan 28 2020 at 13:38)</a>:</h4>
<p>at first glance it seems ok</p>



<a name="186782808"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186782808" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186782808">(Jan 28 2020 at 13:39)</a>:</h4>
<p>I think this is technically UB, since it can create a slice of uninitialized memory.</p>



<a name="186782887"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186782887" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alex Gaynor <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186782887">(Jan 28 2020 at 13:40)</a>:</h4>
<p>IIUC, you want <a href="https://github.com/rust-lang/rust/pull/68234" target="_blank" title="https://github.com/rust-lang/rust/pull/68234">https://github.com/rust-lang/rust/pull/68234</a> which was stabalized yesterday :-)</p>



<a name="186783706"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186783706" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186783706">(Jan 28 2020 at 13:49)</a>:</h4>
<p>It does, but then it immediately uses it for <code>ptr::write_volatile</code>. perhaps there's no need to ever go to a slice to begin with</p>



<a name="186783771"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186783771" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186783771">(Jan 28 2020 at 13:50)</a>:</h4>
<p>One possible course to avoid all that manual multiplication and the unsoundness would be to create a <code>[MaybeUninit&lt;T&gt;]</code> slice instead, is <code>MaybeUninit&lt;T&gt;: Zeroize</code>?</p>



<a name="186784115"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186784115" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186784115">(Jan 28 2020 at 13:54)</a>:</h4>
<p>And if not, it probably should be.</p>



<a name="186784345"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186784345" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186784345">(Jan 28 2020 at 13:57)</a>:</h4>
<p>perhaps <code>MaybeUninit&lt;Z&gt;: Zeroize where Z: Zeroize</code></p>



<a name="186784382"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186784382" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186784382">(Jan 28 2020 at 13:57)</a>:</h4>
<p>or more like <code>MaybeUninit&lt;Z&gt;: Zeroize where Z: DefaultIsZeroes</code></p>



<a name="186784564"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186784564" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186784564">(Jan 28 2020 at 13:59)</a>:</h4>
<p>I mean <code>MaybeUninit&lt;Z&gt;: Zeroize</code> without any conditions. <code>MaybeUninit::zeroed()</code> is stable as well.</p>



<a name="186784612"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186784612" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> HeroicKatora <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186784612">(Jan 28 2020 at 13:59)</a>:</h4>
<p>But of course even with the bound it would be sufficient for this case, you can always relax it later if you feel more comfortable with that course.</p>



<a name="186784768"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186784768" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186784768">(Jan 28 2020 at 14:01)</a>:</h4>
<p>I guess that's an option</p>



<a name="186886856"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186886856" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186886856">(Jan 29 2020 at 13:51)</a>:</h4>
<p>PR updated to work entirely in terms of <code>*mut u8</code></p>



<a name="186886860"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186886860" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186886860">(Jan 29 2020 at 13:51)</a>:</h4>
<p>I think it looks okay now but...</p>



<a name="186900764"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/186900764" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#186900764">(Jan 29 2020 at 16:16)</a>:</h4>
<p>I wonder if there's a safer way to implement it...</p>



<a name="187033620"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/187033620" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#187033620">(Jan 30 2020 at 21:35)</a>:</h4>
<p>heh uhh, what <a href="https://github.com/iqlusioninc/crates/pull/341#discussion_r373196098" target="_blank" title="https://github.com/iqlusioninc/crates/pull/341#discussion_r373196098">https://github.com/iqlusioninc/crates/pull/341#discussion_r373196098</a></p>



<a name="187035939"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/187035939" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#187035939">(Jan 30 2020 at 21:59)</a>:</h4>
<p>aaaand I think we just got further in the weeds <span aria-label="weary" class="emoji emoji-1f629" role="img" title="weary">:weary:</span></p>



<a name="187037180"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/187037180" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#187037180">(Jan 30 2020 at 22:14)</a>:</h4>
<p>I'm failing to see what's "UB" about writing zeros to what is otherwise properly allocated but otherwise uninitialized memory</p>



<a name="187037201"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/187037201" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#187037201">(Jan 30 2020 at 22:15)</a>:</h4>
<p>and then never reading from it until it's initialized</p>



<a name="187038567"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/187038567" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#187038567">(Jan 30 2020 at 22:33)</a>:</h4>
<p>It seems like the argument is: given bugs in the Vec API, and hypothetical changes to the Rust compiler, some ill-defined problem could occur</p>



<a name="187039139"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/187039139" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#187039139">(Jan 30 2020 at 22:39)</a>:</h4>
<p>aah I get it now, it would unsafely expose <code>mem::zeroed</code> to safe Rust via the type parameter</p>



<a name="187039140"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Is%20it%20safe%3F/near/187039140" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Is.20it.20safe.3F.html#187039140">(Jan 30 2020 at 22:39)</a>:</h4>
<p>I hate <code>unsafe</code> <span aria-label="sweat smile" class="emoji emoji-1f605" role="img" title="sweat smile">:sweat_smile:</span></p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>